Yahoo investigating exposure of 400,000 passwords